Microsoft has released a security advisory warning of a new vulnerability in its DirectShow media-streaming architecture for Windows that could allow an attacker to execute code remotely.
The flaw, which Microsoft said is being actively exploited in limited attacks, affects Windows XP, Windows 2000, and Windows Server 2003. Windows Vista and Windows Server 2008 are not affected.
The vulnerability is in the QuickTime parser in DirectShow, according to Microsoft's Security Response Center.
"An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in email," Christopher Budd, security program manager at MSRC, wrote in a blog post.
While the flaw isn't a browser vulnerability, "a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow," he said. Also, it's possible to direct calls to DirectShow even if Apple's QuickTime is installed, he added.
An attacker who successfully exploits the vulnerability could gain the same user rights as the local user, according to Microsoft.
Microsoft posted workarounds in its advisory. More details on the workarounds are available from Microsoft's Security Research and Defense blog.